Answer Explained: Most efficient solution to allow Operations team to fully manage monitoring nodes without alter other resources across tenancy

August 29th 2023

Question

You are the security architect for a medium sized e-commerce company that runs all of their applications in Oracle Cloud Infrastructure (OCI). Currently, there are 14 unique applications, each deployed and secured in their own compartment. The Operations team has procured a new monitoring tool that will be deployed throughout the OCI ecosystem. Their requirement is to deploy one management node into each compartment.

How Xbox Cloud Gaming is Changing the…
Top Reasons to Switch to an Electric …
Exclusive Launch Deal: HIMIWAY Electr…
Unveiling GlyNac: The Breakthrough in…
Is the TP-Link Tapo C100 Security Cam…

Currently, the Operations team Identity and Access Management (IAM) group has the following policy: allow group OpsTeam to READ all-resources in tenancy.

Once the new Monitoring Nodes are deployed, the Operations team may need to stop, start, or reboot them occasionally.

What is the most efficient solution to allow the Operations team to fully manage the monitoring Nodes, without allowing them to alter other resources across the tenancy?

A. In each of the 14 compartments, create a new policy with the following statement: allow group OpsTeam to manage instance-family in compartment XXX where XXX is the name of the compartment where you are creating the policy.
B. Create a new policy in the root compartment with the following policy statement: allow group OpsTeam to manage instance-family in tenancy where ANY (request.operation – ‘UpdateInstance’, request.operation – ‘InstanceAction’)
C. Tag all the monitoring nodes with the defined tag AllPolicy:AllowAccess:OpsTeam and write the following IAM policy: allow group OpsTeam to manage instance-family in tenancy where target.resource.tag.AllPolicy.AllowAccess – ‘OpsTeam’
D. Tag all the monitoring nodes with the free-form tag AllowAccess:OpsTeam and write the following IAM policy: allow group OpsTeam to manage instance-family in tenancy where target.resource.tag.AllowAccess = ‘OpsTeam’

Answer

Explanation 1

The most efficient solution is option A:

In each of the 14 compartments, create a new policy with the following statement: allow group OpsTeam to manage instance-family in compartment XXX where XXX is the name of the compartment where you are creating the policy.

This limits the OpsTeam group’s permissions to only managing the instances (monitoring nodes) within that specific compartment. Since each application is deployed in its own compartment, this ensures OpsTeam can only manage the monitoring nodes for that application and nothing else.

The other options are not as targeted:

B allows OpsTeam to manage instances across the whole tenancy, not just their monitoring nodes.

C and D use tagging, but since existing resources are not tagged, OpsTeam would still have permission to manage all instances, not just their monitoring nodes.

So option A is the most efficient since it grants just the right level of permission for OpsTeam in each specific compartment where they need access.

Here are some additional details regarding option A:

It follows the principle of least privilege by granting only the exact permissions needed. OpsTeam only needs the ability to manage the instances within each specific compartment, so that’s the permission that is granted.
It is very targeted and granular. Since a policy is created within each compartment, OpsTeam’s permissions apply only to that compartment. This avoids blanket permissions across the tenancy.
It is scalable. As more applications are deployed in new compartments, a targeted policy can easily be created within that compartment to allow OpsTeam to manage the monitoring node for that application.
It keeps permissions static. The policies do not rely on tags to dynamically determine access, so OpsTeam’s permissions will remain the same even if tags change.
It is simple to implement and maintain. Creating a single policy within each compartment is straightforward and the policies are self-contained within that scope.
It minimizes security risks. By granting very specific and targeted permissions, it reduces the likelihood of OpsTeam inadvertently impacting other resources within the tenancy.

So in summary, option A provides an efficient and secure way to grant just the right level of access for OpsTeam to manage their monitoring nodes, without allowing broader access across the tenancy. The targeted, compartment-level policies follow the principle of least privilege.

Explanation 2

The correct answer is D. Tag all the monitoring nodes with the free-form tag AllowAccess:OpsTeam and write the following IAM policy: allow group OpsTeam to manage instance-family in tenancy where target.resource.tag.AllowAccess = ‘OpsTeam’.

The Operations team needs to be able to manage the monitoring nodes, which means they need to be able to perform the following actions:

Stop the nodes
Start the nodes
Reboot the nodes

The most efficient way to allow the Operations team to perform these actions is to tag the monitoring nodes with the free-form tag AllowAccess:OpsTeam. Then, you can create an IAM policy that allows the Operations team to manage instance-family resources in the tenancy where the tag AllowAccess:OpsTeam is present.

The policy statement would look like this:

allow group OpsTeam to manage instance-family in tenancy where target.resource.tag.AllowAccess = ‘OpsTeam’

This policy would allow the Operations team to perform the necessary actions on the monitoring nodes, without giving them access to other resources in the tenancy.

The other options are not as efficient as tagging the monitoring nodes with a free-form tag and creating an IAM policy.

Option A: Creating a new policy in each of the 14 compartments would be very time-consuming and would not be scalable.

Option B: Creating a new policy in the root compartment with the ANY operator would allow the Operations team to perform more actions than they need to.

Option C: Creating a policy that allows the Operations team to manage instance-family resources in the tenancy where the tag AllPolicy:AllowAccess:OpsTeam is present would not be specific enough. It is possible that other resources in the tenancy could have the tag AllPolicy:AllowAccess:OpsTeam, and the Operations team would not want to be able to manage those resources.

Explanation 3

Option C is the most efficient solution. It would involve:

Tagging all the monitoring nodes with the defined tag AllPolicy:AllowAccess:OpsTeam
Creating an IAM policy with the following statement:

allow group OpsTeam to manage instance-family in tenancy where target.resource.tag.AllPolicy.AllowAccess = ‘OpsTeam’

This allows the OpsTeam group to manage only the resources with that specific tag, limiting their access to just the monitoring nodes without giving them blanket access across the entire tenancy.

The key aspects are:

Using a defined tag to label the specific resources
Using a tag-based IAM policy to limit the scope of access to just those tagged resources
Allowing manage actions on the instance resource type, which covers start, stop, and reboot operations.

Explanation 4

The correct answer is C. Tag all the monitoring nodes with the defined tag AllPolicy:AllowAccess:OpsTeam and write the following IAM policy: allow group OpsTeam to manage instance-family in tenancy where target.resource.tag.AllPolicy.AllowAccess – ‘OpsTeam’.

The Operations team needs to be able to manage the monitoring nodes, which means they need to be able to perform the following actions:

Stop the nodes
Start the nodes
Reboot the nodes

The most efficient way to allow the Operations team to perform these actions is to tag the monitoring nodes with the defined tag AllPolicy:AllowAccess:OpsTeam and write the following IAM policy:

allow group OpsTeam to manage instance-family in tenancy where target.resource.tag.AllPolicy.AllowAccess = ‘OpsTeam’

This policy will allow the Operations team to perform the required actions on the monitoring nodes, but it will not allow them to perform any other actions on any other resources in the tenancy.

The other options are not as efficient as tagging the monitoring nodes and writing a policy.

Option A: Creating a new policy in each of the 14 compartments with the following statement: allow group OpsTeam to manage instance-family in compartment XXX where XXX is the name of the compartment where you are creating the policy.

This option would be very inefficient, as it would require creating 14 separate policies.

Option B: Creating a new policy in the root compartment with the following policy statement: allow group OpsTeam to manage instance-family in tenancy where ANY (request.operation – ‘UpdateInstance’, request.operation – ‘InstanceAction’)

This option would allow the Operations team to perform the required actions on the monitoring nodes, but it would also allow them to perform other actions on other resources in the tenancy. This is not desirable, as it would increase the risk of unauthorized access.

Option D: Tag all the monitoring nodes with the free-form tag AllowAccess:OpsTeam and write the following IAM policy: allow group OpsTeam to manage instance-family in tenancy where target.resource.tag.AllowAccess = ‘OpsTeam’

This option is similar to Option C, but it uses a free-form tag instead of a defined tag. This is not as efficient, as it would require manually creating the tag on each monitoring node.

Explanation 5

The most efficient solution to allow the Operations team to fully manage the monitoring nodes, without allowing them to alter other resources across the tenancy, would be option C: Tag all the monitoring nodes with the defined tag AllPolicy:AllowAccess:OpsTeam and write the following IAM policy: allow group OpsTeam to manage instance-family in tenancy where target.resource.tag.AllPolicy.AllowAccess – ‘OpsTeam’.

By tagging the monitoring nodes with a specific tag, you can create a targeted IAM policy that grants the OpsTeam group the necessary permissions to manage the instance-family resources in the tenancy, specifically for resources with the tag “AllPolicy:AllowAccess:OpsTeam”. This approach ensures that the Operations team can only manage the monitoring nodes and not other resources in the tenancy.

Explanation 6

The most efficient solution to allow the Operations team to fully manage the monitoring nodes, without allowing them to alter other resources across the tenancy, would be option C:

C. Tag all the monitoring nodes with the defined tag AllPolicy:AllowAccess:OpsTeam and write the following IAM policy: allow group OpsTeam to manage instance-family in tenancy where target.resource.tag.AllPolicy.AllowAccess – ‘OpsTeam’

Option C proposes using a defined tag (AllPolicy:AllowAccess:OpsTeam) and an IAM policy to control access to the monitoring nodes. This approach allows for granular access control and ensures that only the specified Operations team (OpsTeam) can manage the instance-family resources (monitoring nodes) within each compartment.

By tagging all the monitoring nodes with the defined tag, it becomes easier to identify and manage them as a specific group of resources. The IAM policy restricts access to only instances (monitoring nodes) that have the tag “AllPolicy:AllowAccess:OpsTeam,” effectively granting the OpsTeam the required management privileges for the monitoring nodes across the entire tenancy without giving them access to other resources.

This solution is more efficient than option A, which requires creating a separate policy for each of the 14 compartments. Option B may not be the best fit as it does not involve using tags, and it allows the OpsTeam to manage instances in the entire tenancy, which may not be desirable. Option D suggests using a free-form tag, which might lead to ambiguity or inconsistency in managing resources.

Therefore, option C is the most appropriate and efficient solution for the scenario described.

Explanation 7

The Operations team needs to be able to manage the monitoring nodes, which means they need to be able to perform the following actions:

Stop
Start
Reboot

The most efficient way to allow the Operations team to perform these actions is to tag the monitoring nodes with the free-form tag AllowAccess:OpsTeam. Then, you can create an IAM policy that allows the OpsTeam group to manage instance-family resources in the tenancy where the target resource’s tag AllowAccess = ‘OpsTeam’.

This policy will allow the OpsTeam group to perform the necessary actions on the monitoring nodes without giving them access to other resources in the tenancy.

The other options are not as efficient.

This option would be very time-consuming and would require a lot of manual effort.

This option would give the OpsTeam group too much permissions. They would be able to perform any action on any instance-family resource in the tenancy.

Therefore, the best solution is to tag the monitoring nodes with the free-form tag AllowAccess:OpsTeam and write the following IAM policy: allow group OpsTeam to manage instance-family in tenancy where target.resource.tag.AllowAccess = ‘OpsTeam’.

Explanation 8

The most efficient solution to allow the Operations team to fully manage the monitoring nodes, without allowing them to alter other resources across the tenancy, is option C. Tag all the monitoring nodes with the defined tag AllPolicy:AllowAccess:OpsTeam and write the following IAM policy: allow group OpsTeam to manage instance-family in tenancy where target.resource.tag.AllPolicy.AllowAccess – ‘OpsTeam’.

This solution uses a defined tag, which is a key-value pair that you define in a tag namespace and apply to resources. Defined tags can be used in IAM policies to grant or deny access based on the tag values. In this case, the defined tag AllPolicy:AllowAccess:OpsTeam indicates that the OpsTeam group has permission to manage the instance-family resources that have this tag. The IAM policy statement uses the target.resource.tag condition to match the tag value with the group name.

Option A is not efficient because it requires creating 14 separate policies in each compartment. Option B is not correct because it uses an invalid syntax for the condition (ANY instead of ANYOF) and it does not restrict the access to only the monitoring nodes. Option D is not correct because it uses a free-form tag, which is a key-value pair that you can apply to resources without defining them in a tag namespace. Free-form tags cannot be used in IAM policies.

Explanation 9

The most efficient solution to allow the Operations team to fully manage the monitoring nodes, without allowing them to alter other resources across the tenancy, is option D.

Option D uses a free-form tag to identify the monitoring nodes and a tag-based policy to grant the OpsTeam group the permission to manage them. This way, you don’t need to create multiple policies in each compartment or use complex conditions in the root policy. You can also easily add or remove nodes from the policy by changing their tags.

Option A would work, but it is not efficient because you would have to create 14 policies and maintain them separately.

Option B would not work, because it uses an invalid syntax for the policy condition. The correct syntax is where ANY {request.operation = 'UpdateInstance', request.operation = 'InstanceAction'}.

Option C would not work, because it uses a defined tag instead of a free-form tag. Defined tags require a tag namespace and a tag key, which are not specified in the option.

Explanation 10

Option C suggests using tags to control access to the monitoring nodes. Tags are key-value pairs that you can assign to resources in OCI. They provide a flexible and powerful way to organize and manage your resources, and they can also be used for access control purposes.

In this solution, you would tag all the monitoring nodes with a specific defined tag, such as “AllPolicy:AllowAccess:OpsTeam”. This tag serves as a marker to identify the resources that the Operations team should have access to.

Next, you would write an IAM policy that allows the OpsTeam group to manage the instance-family resources in the tenancy where the target resource tag matches “AllPolicy:AllowAccess:OpsTeam”. This policy ensures that the Operations team can only manage the monitoring nodes and not alter other resources across the tenancy.

By using tags and a targeted IAM policy, you can achieve fine-grained access control for the Operations team, allowing them to fully manage the monitoring nodes while maintaining the security and integrity of other resources in the tenancy.

Benefits of this solution include:

Granular access control: The solution provides precise control over which resources the Operations team can manage. They are limited to the monitoring nodes and cannot modify or access other resources without the appropriate tags.
Scalability and ease of management: Using tags allows you to apply the policy consistently across multiple compartments and resources. It simplifies the management process by centralizing access control rules based on the defined tag.
Flexibility: Tags can be easily added or removed from resources as needed, providing flexibility in adjusting access control policies as your environment evolves.
Enhanced security: By restricting access to specific resources, you reduce the risk of accidental or unauthorized modifications to critical components of your infrastructure.

Overall, the solution using tags and a targeted IAM policy offers an efficient and effective approach to granting the Operations team the necessary access to manage the monitoring nodes while maintaining the security and integrity of other resources in the tenancy.

Explanation 11

The most efficient solution to allow the Operations team to fully manage the monitoring nodes, without allowing them to alter other resources across the tenancy, is option D.

Option D uses a free-form tag to identify the monitoring nodes and a conditional policy statement to grant the OpsTeam group the permission to manage the instance-family resource type in the tenancy. This way, the OpsTeam can only perform actions on the instances that have the tag AllowAccess:OpsTeam, and not on any other resources.

Option A is not efficient because it requires creating 14 policies in each compartment, which is tedious and error-prone.

Option B is not correct because it uses an invalid syntax for the policy statement. The ANY operator should be followed by a list of conditions separated by commas, not by dashes.

Option C is not correct because it uses a defined tag, which requires creating a tag namespace and a tag key before applying it to the resources. This adds extra complexity and overhead to the solution.

Explanation 12

The most efficient solution to allow the Operations team to fully manage the monitoring nodes, without allowing them to alter other resources across the tenancy, is:

D. Tag all the monitoring nodes with the free-form tag AllowAccess:OpsTeam and write the following IAM policy: allow group OpsTeam to manage instance-family in tenancy where target.resource.tag.AllowAccess = ‘OpsTeam’

Option D utilizes tagging to provide the necessary access control. By tagging all the monitoring nodes with the free-form tag “AllowAccess:OpsTeam,” you can create an IAM policy that allows the OpsTeam group to manage instance-family resources in the tenancy based on the specified tag.

This approach provides a fine-grained and scalable solution as it is independent of the number of compartments. The Operations team will have full management capabilities over the monitoring nodes without being able to modify other resources in the tenancy.

Options A and B suggest creating separate policies for each compartment or at the root compartment level, respectively. While they may work, they are less efficient and require additional policy management and maintenance as the number of compartments increases or changes.

Option C suggests using a defined tag “AllPolicy:AllowAccess:OpsTeam” for the monitoring nodes. However, it is not mentioned if this tag is already in use or available. Additionally, using a free-form tag (Option D) allows more flexibility and does not rely on a specific predefined tag structure.

Therefore, option D is the most efficient and flexible solution for granting the Operations team management access to the monitoring nodes while ensuring control over other resources in the tenancy.

Explanation 13

The most efficient solution to allow the Operations team to fully manage the monitoring nodes, without allowing them to alter other resources across the tenancy is option D:

Tag all the monitoring nodes with the free-form tag AllowAccess:OpsTeam and write the following IAM policy: allow group OpsTeam to manage instance-family in tenancy where target.resource.tag.AllowAccess = ‘OpsTeam’

Here’s why this option is the most efficient solution:

Option A: In each of the 14 compartments, create a new policy with the specific statement. This would require creating a policy for each compartment, resulting in more policy management overhead and potential for errors.
Option B: Create a new policy in the root compartment with an exception for specific operations. This approach could potentially be error-prone and may require frequent updates to the policy as new operations are introduced. It also grants more permissions than necessary.
Option C: Tag all the monitoring nodes with the defined tag AllPolicy:AllowAccess:OpsTeam and write the corresponding IAM policy. This option requires creating and managing a specific tag, which may introduce additional complexity and potential for mistakes.

Option D, on the other hand, offers a more straightforward and efficient approach:

By tagging all the monitoring nodes with the free-form tag AllowAccess:OpsTeam, you can easily identify and manage them as a group.
Writing an IAM policy that allows the OpsTeam group to manage the instance-family in the tenancy based on the tag target.resource.tag.AllowAccess = ‘OpsTeam’ ensures that only the designated nodes can be managed by the Operations team.
This approach reduces the complexity of managing individual policies for each compartment or defining specific operations exceptions, while still providing the necessary access control for the Operations team to manage the monitoring nodes.

Overall, option D provides a simpler and more scalable solution to allow the Operations team to manage the monitoring nodes without compromising the security or altering other resources across the tenancy.

Explanation 14

The most efficient solution to allow the Operations team to fully manage the monitoring nodes without allowing them to alter other resources across the tenancy is:

This approach allows the Operations team to manage the monitoring nodes without granting them access to all resources in the tenancy. By tagging the monitoring nodes with a specific tag (AllPolicy:AllowAccess:OpsTeam), the IAM policy can be tailored to only apply to those resources that have been tagged, ensuring that the Operations team can only manage the monitoring nodes and not any other resources in the tenancy.

Here’s a summary of the advantages of this approach:

Granular access control: By using tags to identify the monitoring nodes, the IAM policy can be tailored to only apply to those resources, ensuring that the Operations team can only manage the monitoring nodes and not any other resources in the tenancy.
Efficient: This approach is efficient because it allows the Operations team to manage all the monitoring nodes from a single policy, without the need to create multiple policies or modify existing policies.
Scalable: As the number of monitoring nodes grows, the approach can be easily scaled by adding the AllPolicy:AllowAccess:OpsTeam tag to new monitoring nodes, without the need to update the IAM policy.

The other options are not as efficient or scalable:

This approach requires creating 14 separate policies, which can be time-consuming and difficult to maintain. It also does not provide a consistent access control model across the tenancy, as each compartment has its own policy.

B. Create a new policy in the root compartment with the following policy statement: allow group OpsTeam to manage instance-family in tenancy where ANY (request.operation – ‘UpdateInstance’, request.operation – ‘InstanceAction’)

This approach grants the Operations team too much access, allowing them to manage all instance-family resources in the tenancy, including resources that they should not have access to. It also does not provide a granular access control model, as the policy applies to all instance-family resources in the tenancy.

This approach is similar to option C, but it uses a free-form tag instead of a defined tag. This can lead to inconsistencies in tagging and make it more difficult to manage the access control model. Additionally, using a free-form tag does not provide the same level of granularity as a defined tag, as it can be applied to any resource, not just monitoring nodes.

Explanation 15

Based on the requirements, the most efficient solution to allow the Operations team to fully manage the monitoring nodes without allowing them to alter other resources across the tenancy is:

C. Tag all the monitoring nodes with the defined tag `AllPolicy:AllowAccess:OpsTeam` and write the following IAM policy: allow group OpsTeam to manage instance-family in tenancy where target.resource.tag.AllPolicy.AllowAccess – ‘OpsTeam’

Here’s why:

By tagging the monitoring nodes with a defined tag, you can target those nodes specifically with the IAM policy.
The `AllPolicy:AllowAccess:OpsTeam` tag is a free-form tag that can be applied to any resource in the tenancy, including the monitoring nodes.
The IAM policy allows the OpsTeam to manage instance-family in tenancy where the target resource has the `AllPolicy:AllowAccess:OpsTeam` tag. This ensures that the OpsTeam can manage the monitoring nodes, but not other resources in the tenancy.

Option A is not efficient because it requires creating a new policy in each compartment, which can be time-consuming and increase the risk of errors.

Option B is not efficient because it allows the OpsTeam to manage any resource in the tenancy that has the `ANY` keyword, which is too broad and could potentially expose other resources to unauthorized access.

Option D is not efficient because it uses a free-form tag, which can be less secure than a defined tag like `AllPolicy:AllowAccess:OpsTeam`. Additionally, it requires the OpsTeam to have access to the free-form tag, which may not be appropriate.

Explanation 16

The most efficient solution to allow the Operations team to fully manage the monitoring nodes without allowing them to alter other resources across the tenancy is option B:

Create a new policy in the root compartment with the following policy statement:

allow group OpsTeam to manage instance-family in tenancy where ANY (request.operation – ‘UpdateInstance’, request.operation – ‘InstanceAction’)

This policy grants the Operations team (group OpsTeam) permission to manage all instances in the tenancy, regardless of which compartment they are located in, using any operation (UpdateInstance or InstanceAction). This will allow the Operations team to stop, start, or reboot the monitoring nodes as needed without affecting other resources in the tenancy.

Option A creates a new policy in each of the 14 compartments, which can lead to unnecessary complexity and duplication of policies. Option C uses free-form tags, which can be less manageable than using a defined policy. Option D grants permission to manage all resources in the tenancy, which may not be desirable depending on the organization’s security policies.

Explanation 17

The correct answer is D.

The Operations team needs to be able to stop, start, or reboot the monitoring nodes. This requires the ability to manage instance-family resources. However, the Operations team should not be able to manage other resources in the tenancy.

To achieve this, we can tag the monitoring nodes with the free-form tag AllowAccess:OpsTeam. We can then write the following IAM policy:

allow group OpsTeam to manage instance-family in tenancy where target.resource.tag.AllowAccess = ‘OpsTeam’

This policy will allow the Operations team to manage instance-family resources in the tenancy, but only if the resources are tagged with the AllowAccess:OpsTeam tag. This will ensure that the Operations team cannot manage other resources in the tenancy.

Explanation 18

The correct answer to your question is D. Tag all the monitoring nodes with the free-form tag AllowAccess:OpsTeam and write the following IAM policy: allow group OpsTeam to manage instance-family in tenancy where target.resource.tag.AllowAccess = ‘OpsTeam’.

Let me explain why this option meets the requirements of the scenario:

Tagging is a feature of OCI that allows you to apply metadata to your resources, such as instances, block volumes, buckets, etc. You can use tags to organize, track, and control access to your resources. There are two types of tags in OCI: defined tags and free-form tags. Defined tags are created by administrators and have a predefined set of values, while free-form tags are created by users and can have any value.
IAM policies are rules that define who can access which resources in OCI. You can use IAM policies to grant or deny permissions to users, groups, compartments, and dynamic groups. You can also use conditions in IAM policies to specify additional criteria for granting or denying access, such as time, IP address, tag value, etc.
In this scenario, you want to allow the Operations team to fully manage the monitoring nodes, without allowing them to alter other resources across the tenancy. To achieve this, you can use free-form tags to mark the monitoring nodes with a unique identifier, such as AllowAccess:OpsTeam. Then, you can write an IAM policy that grants the OpsTeam group the permission to manage instance-family (which includes instances and boot volumes) in the tenancy, but only if the target resource has the tag value AllowAccess:OpsTeam. This way, you can restrict the access of the OpsTeam group to only the monitoring nodes across the tenancy.

The other options are not correct for the following reasons:

A. In each of the 14 compartments, create a new policy with the following statement: allow group OpsTeam to manage instance-family in compartment XXX where XXX is the name of the compartment where you are creating the policy: This option will not meet the requirement of efficiency. Creating a new policy in each compartment will require a lot of manual work and maintenance. Moreover, this option will grant the OpsTeam group the permission to manage all instances and boot volumes in each compartment, not just the monitoring nodes.
B. Create a new policy in the root compartment with the following policy statement: allow group OpsTeam to manage instance-family in tenancy where ANY (request.operation – ‘UpdateInstance’, request.operation – ‘InstanceAction’): This option will not meet the requirement of security. This policy will grant the OpsTeam group the permission to manage all instances and boot volumes in the tenancy, not just the monitoring nodes. Moreover, this policy will allow them to perform any operation on instance-family, not just stop, start, or reboot.
C. Tag all the monitoring nodes with the defined tag AllPolicy:AllowAccess:OpsTeam and write the following IAM policy: allow group OpsTeam to manage instance-family in tenancy where target.resource.tag.AllPolicy.AllowAccess – ‘OpsTeam’: This option will not work because it uses an invalid syntax for both tagging and IAM policy. First, defined tags must have a namespace and a key-value pair separated by a dot (.), not a colon (:). Second, IAM policies must use an equal sign (=), not a dash (-), to compare tag values.

Reference

Overview of Identity and Access Management (oracle.com)
Common Policies (oracle.com)
Oracle Cloud Infrastructure Federation with OCI IAM Identity Domains
Getting Started with Policies (oracle.com)
Create an IAM Policy (oracle.com)
Tags and Tag Namespace Concepts (oracle.com)
Policy Reference (without Identity Domains) (oracle.com)
Overview of IAM (oracle.com)
Creating an Instance (oracle.com)
Cloud Compute | Oracle

Oracle Cloud Infrastructure 2022 Architect Professional 1z0-997-22 certification exam practice question and answer (Q&A) dump with detail explanation and reference available free, helpful to pass the Oracle Cloud Infrastructure 2022 Architect Professional 1z0-997-22 exam and earn Oracle Cloud Infrastructure 2022 Architect Professional 1z0-997-22 certification.

The post Answer Explained: Most efficient solution to allow Operations team to fully manage monitoring nodes without alter other resources across tenancy appeared first on PUPUWEB - Information Resource for Emerging Technology Trends and Cybersecurity.

This post first appeared on PUPUWEB - Information Resource For Emerging Technology Trends And Cybersecurity, please read the originial post: here